Comprehensive legacy codebase analysis skill with automated tools for technical debt assessment, security vulnerability detection, performance analysis, and strategic modernization planning. Transforms complex legacy systems into actionable modernization roadmaps through seven production-ready Python analysis tools.
Overview
This skill delivers enterprise-grade legacy codebase analysis capabilities through seven specialized Python automation tools and extensive reference documentation. Whether assessing technical debt, scanning for security vulnerabilities, identifying performance bottlenecks, or planning modernization strategies, this skill provides the analytical depth and strategic guidance needed to transform legacy systems into modern, maintainable architectures.
Target Users:
Engineering leaders managing legacy system modernization
CTOs planning technical debt reduction strategies
Architects designing migration paths to modern stacks
Security teams auditing legacy application vulnerabilities
{"summary":{"total_vulnerabilities":47,"critical":3,"high":12,"medium":23,"low":9,"owasp_coverage":{"A01:2021-Broken Access Control":5,"A02:2021-Cryptographic Failures":3,"A03:2021-Injection":8}},"vulnerabilities":[{"id":"VUL-001","type":"SQL Injection","severity":"critical","file":"app/models/user.py","line":145,"description":"Unsanitized user input in SQL query","code_snippet":"query = f\"SELECT * FROM users WHERE id = {user_id}\"","remediation":"Use parameterized queries: cursor.execute('SELECT * FROM users WHERE id = %s', (user_id,))","owasp":"A03:2021-Injection","cwe":"CWE-89"}]}
3. Performance Bottleneck Detector
Algorithm complexity analysis and performance optimization identification.
{"summary":{"total_bottlenecks":34,"critical":5,"high":14,"medium":15,"categories":{"algorithm":12,"database":15,"memory":4,"io":3}},"bottlenecks":[{"id":"PERF-001","type":"Nested Loop (O(n²))","severity":"critical","file":"app/services/report_generator.py","line":78,"description":"Nested loops causing quadratic complexity","code_snippet":"for user in users:\n for order in orders:\n if order.user_id == user.id:","impact":"Processing time increases exponentially with data size","recommendation":"Use dictionary lookup: orders_by_user = {o.user_id: o for o in orders}","estimated_improvement":"95% reduction in processing time"}]}
4. Code Quality Analyzer
Comprehensive code quality metrics and maintainability assessment.
{"summary":{"overall_score":62,"maintainability":"medium","complexity":{"average":8.4,"high_complexity_files":23},"duplication":{"percentage":12.3,"duplicate_lines":17890},"test_coverage":{"estimated":"45%","files_without_tests":145}},"files":[{"path":"app/services/order_processor.py","complexity":28,"maintainability_index":42,"loc":450,"comment_ratio":0.08,"issues":["Cyclomatic complexity too high (threshold: 15)","Function too long: process_order (180 lines)","Low comment density (8%)"],"recommendations":["Split process_order into smaller functions","Reduce conditional nesting","Add docstrings and inline comments"]}]}
5. Architecture Health Analyzer
Dependency graph analysis and architectural quality assessment.
{"summary":{"health_score":58,"circular_dependencies":7,"layer_violations":12,"anti_patterns":["God Object","Spaghetti Code","Tight Coupling"],"coupling_score":"high","cohesion_score":"low"},"modules":[{"name":"app.services.order_service","dependencies_in":18,"dependencies_out":24,"coupling":"very_high","issues":["God Object anti-pattern detected","Depends on 24 other modules","Violates Single Responsibility Principle"],"recommendations":["Split into domain-specific services","Introduce dependency inversion","Define clear interfaces"]}],"circular_dependencies":[{"cycle":["app.models.user","app.services.auth","app.models.session","app.models.user"],"severity":"high","impact":"Difficult to test and maintain"}]}
6. Technical Debt Scorer
Multi-dimensional technical debt quantification and prioritization.
{"summary":{"overall_score":68,"rating":"medium_debt","total_remediation_days":127,"categories":{"code_quality":{"score":62,"debt_days":35},"architecture":{"score":55,"debt_days":48},"security":{"score":71,"debt_days":22},"performance":{"score":78,"debt_days":12},"testing":{"score":45,"debt_days":10}}},"prioritized_items":[{"id":"DEBT-001","category":"architecture","title":"Resolve circular dependencies in core modules","impact":"high","effort":"medium","priority":"quick_win","remediation_days":8,"risk_if_deferred":"Increasingly difficult to add features without breaking changes","roi":"high"}],"trend":{"current_score":68,"previous_score":65,"change":-3,"direction":"worsening"}}
7. Modernization Roadmap Generator
Strategic migration planning with phased approaches and ROI analysis.
Key Features:
Current state to target state gap analysis
Migration strategy recommendations (Strangler Fig, Big Bang, etc.)
# Legacy System Modernization Roadmap## Executive Summary**Current State:** Monolithic Django 2.2 application with 145K LOC
**Target State:** Microservices architecture with modern Python 3.11+ and containerization
**Timeline:** 18 months
**Estimated Cost:** $1.2M (8-person team)
**Expected ROI:** 3x over 3 years
## Phase 1: Foundation (Months 1-3)**Objectives:**- Establish modern CI/CD pipeline
- Implement comprehensive test suite
- Containerize existing application
- Set up monitoring and observability
**Deliverables:**- CI/CD pipeline (GitHub Actions)
- Test coverage increased to 70%
- Docker containerization complete
- APM and logging infrastructure
**Resources:** 2 DevOps, 3 Backend Engineers
**Cost:** $150K
## Phase 2: API Gateway and Bounded Contexts (Months 4-9)**Objectives:**- Implement API Gateway
- Extract first bounded contexts
- Migrate authentication service
- Deploy side-by-side with monolith
**Deliverables:**- API Gateway operational
- Auth microservice extracted
- User management microservice
- 20% of traffic on new services
**Resources:** 1 Architect, 4 Backend Engineers, 1 DevOps
**Cost:** $450K
## Risk Assessment**High Risks:**- Data migration complexity
- Integration challenges between old and new
- User disruption during cutover
**Mitigation:**- Comprehensive testing at each phase
- Blue-green deployment strategy
- Feature flags for gradual rollout
- Rollback procedures documented
Reference Documentation
Detailed guides available in the references/ directory:
Works with code-reviewer skill for ongoing quality maintenance:
# 1. Legacy analysis identifies problem areas
python scripts/code_quality_analyzer.py /path/to/legacy-project --min-complexity 15
# 2. Code reviewer focuses on those areas
python skills/engineering-team/code-reviewer/scripts/pr_analyzer.py 123 --focus high-complexity
# 3. Track improvement over time
python scripts/technical_debt_scorer.py /path/to/legacy-project --compare baseline.json
Integration with Security Workflow
Complements security audits from secops skill:
# 1. Automated vulnerability scanning
python scripts/security_vulnerability_scanner.py /path/to/legacy-project --detailed
# 2. Deep security analysis (manual)# Use cs-secops-engineer agent for comprehensive audit# 3. Track remediation progress
python scripts/security_vulnerability_scanner.py /path/to/legacy-project --compare baseline-security.json
Integration with Architecture Planning
Feeds into architectural decisions via architect skill:
# 1. Analyze current architecture health
python scripts/architecture_health_analyzer.py /path/to/legacy-project --detailed
# 2. Design target architecture# Use cs-architect agent for target state design# 3. Generate migration roadmap
python scripts/modernization_roadmap_generator.py /path/to/legacy-project --timeline 18
Troubleshooting
Common Issues
Issue: Tool runs slowly on large codebases
# Solution: Use file type filtering
python scripts/codebase_inventory.py /path/to/project --file-types .py,.js --exclude node_modules,venv
# Or exclude specific directories
python scripts/code_quality_analyzer.py /path/to/project --exclude tests,migrations,fixtures
Issue: Too many false positives in security scan
# Solution: Adjust severity threshold and use suppressions
python scripts/security_vulnerability_scanner.py /path/to/project --min-severity high --suppress-file .security-suppressions.json
Issue: Performance detector missing known bottlenecks
# Solution: Use verbose mode and manual review
python scripts/performance_bottleneck_detector.py /path/to/project --verbose --detailed
# Combine with profiling data from actual runtime# Reference: references/analysis_framework.md section on profiling integration
Issue: Technical debt score doesn't match intuition
